Add Proxmox worker CT, off-box watch, backup, and tagged deploy.

NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker
10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222.
verae-uptime GET-watches public doors; verae-backup snapshots SQLite and
worm/tree data; verae-deploy does host-deps + checkout + npm ci.
Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON).
User systemd + linger for keep and fleet survive reboot.

packages/verae-backup/scripts/restore.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+# Restore a .tgz from backup.sh. Default is --dry-run.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck disable=SC1091
+. "$ROOT/paths.env"
+DRY=1
+ARCHIVE=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --apply) DRY=0 ;;
+    --dry-run) DRY=1 ;;
+    --archive) ARCHIVE="${2:-}"; shift ;;
+    *) echo "usage: restore.sh [--dry-run|--apply] [--archive file.tgz]" >&2; exit 1 ;;
+  esac
+  shift
+done
+if [[ -z "$ARCHIVE" ]]; then
+  ARCHIVE="$(ls -1t "$BACKUP_ROOT"/*.tgz 2>/dev/null | head -1 || true)"
+fi
+[[ -n "$ARCHIVE" && -f "$ARCHIVE" ]] || { echo "no archive" >&2; exit 1; }
+echo "archive $ARCHIVE dry=$DRY"
+TMP="$(mktemp -d)"
+tar -xzf "$ARCHIVE" -C "$TMP"
+INNER="$(find "$TMP" -mindepth 1 -maxdepth 1 -type d | head -1)"
+restore_one() {
+  local from="$1" to="$2"
+  [[ -e "$from" ]] || { echo "skip $from"; return; }
+  echo "would restore $from -> $to"
+  if [[ $DRY -eq 0 ]]; then
+    mkdir -p "$(dirname "$to")"
+    rm -rf "$to"
+    cp -a "$from" "$to"
+  fi
+}
+restore_one "$INNER/sqlite/$(basename "$ZAPPIER_DB")" "$ZAPPIER_DB"
+restore_one "$INNER/iam/$(basename "$IAM_DATA")" "$IAM_DATA"
+restore_one "$INNER/keep/$(basename "$KEEP_DATA")" "$KEEP_DATA"
+restore_one "$INNER/fleet-runtime/$(basename "$FLEET_RUNTIME")" "$FLEET_RUNTIME"
+restore_one "$INNER/nats/$(basename "$NATS_STORE")" "$NATS_STORE"
+rm -rf "$TMP"
+if [[ $DRY -eq 1 ]]; then
+  echo "dry-run only. re-run with --apply after stopping keep/fleet/nats consumers."
+fi